Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 17:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll
Resource
win7-20240704-en
3 signatures
150 seconds
General
-
Target
6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll
-
Size
152KB
-
MD5
6407e93b8a0ab79720d2c651f1ec5242
-
SHA1
129c7ff74800fa4f610378fcd1b7632ba7fa2011
-
SHA256
7313d8f89ab29beaca4a53ea584c1562fc8530440bb2d0037604b1cadc7af636
-
SHA512
acdc5f195f8251fc8633df4a44daf3ed10082ffab7aec03824771c64e919b3c8c00ace4c9959d792511f4531830e81e62ce92d9782b393879a92189e7cf530d3
-
SSDEEP
3072:VmRaJnWY39AA6z/8XHtTCr1HiymUJO2VbGnlyWCtc4Qb:VQaPKFeki3zVATAb
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE580665-F3F7-4D64-86F8-14AC84FFC810} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\ = "CMVideoPlugin" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\ = "IXMLDOMDocumentEventsSink" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1\CLSID\ = "{CE580665-F3F7-4D64-86F8-14AC84FFC810}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\ = "CMVideoPlugin Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\VersionIndependentProgID\ = "CMVideo.CMVideoPlugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\AppID = "{E006ADC6-996A-4EE2-9D63-E6E607485D9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\ = "CMVideo 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D}\TypeLib\ = "{B4ACF1F7-325C-4269-A5E2-645476428B8C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1\CLSID\ = "{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\ = "XMLDOMDocumentEventsSink Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin\CLSID\ = "{CE580665-F3F7-4D64-86F8-14AC84FFC810}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\TypeLib\ = "{B4ACF1F7-325C-4269-A5E2-645476428B8C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\ = "IXMLDOMDocumentEventsSink" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1\ = "XMLDOMDocumentEventsSink Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin\CurVer\ = "CMVideo.CMVideoPlugin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E006ADC6-996A-4EE2-9D63-E6E607485D9F}\ = "CMVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1\ = "CMVideoPlugin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\ProgID\ = "CMVideo.CMVideoPlugin.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\TypeLib\ = "{B4ACF1F7-325C-4269-A5E2-645476428B8C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CMVideo.DLL\AppID = "{E006ADC6-996A-4EE2-9D63-E6E607485D9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\ProgID\ = "CMVideo.XMLDOMDocumentEventsSink.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\TypeLib\ = "{B4ACF1F7-325C-4269-A5E2-645476428B8C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin\ = "CMVideoPlugin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A77A8135-C1D5-40E4-A4F1-51FA11936B5D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink\ = "XMLDOMDocumentEventsSink Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A8A5904-FD83-40DF-BA27-7D5704EF6FFA}\AppID = "{E006ADC6-996A-4EE2-9D63-E6E607485D9F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE580665-F3F7-4D64-86F8-14AC84FFC810}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ACF1F7-325C-4269-A5E2-645476428B8C}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD57F97B-89EB-4769-8894-7D16528C44D9}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4292 5044 regsvr32.exe 84 PID 5044 wrote to memory of 4292 5044 regsvr32.exe 84 PID 5044 wrote to memory of 4292 5044 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6407e93b8a0ab79720d2c651f1ec5242_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4292
-